CVE-2024-28827 Privilege escalation in Windows agent

What is CVE-2024-28827?

CVE-2024-28827 is a high-severity vulnerability in Checkmk Checkmk, published on 10 Jul 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Incorrect permissions on the Checkmk Windows Agent's data directory in Checkmk < 2.3.0p8, < 2.2.0p29, < 2.1.0p45, and <= 2.0.0p39 (EOL) allows a local attacker to gain SYSTEM privileges.

Weakness: CWE-732

Which versions are affected by CVE-2024-28827?

It affects 1 product.

Products include Checkmk Checkmk.

How do I fix CVE-2024-28827?

No fix has been published for CVE-2024-28827 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-28827 being exploited?

There is no known exploitation of CVE-2024-28827 in the wild and no public exploit code.

Other vulnerabilities in Checkmk Checkmk

• CVE-2025-39666 omd: Local privilege escalation when executing omd commands as root Critical 9.3
• CVE-2024-8606 Fix 2FA bypass via RestAPI Critical 9.2
• CVE-2022-46836 PHP code injection in watolib Critical 9.1
• CVE-2025-32919 Privilege Escalation in Windows License plugin for Checkmk Windows Agent High 8.8
• CVE-2024-28828 1-Click compromize via CSRF High 8.8

All Checkmk Checkmk vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-hxwp-wpwp-65p6, UBUNTU-CVE-2024-28827.